Four ways AI has fundamentally changed the threat landscape in 2026

Sysdig TRT reports that agentic AI is now carrying out attacks end to end, including rapid exploitation, credential theft, container escapes, and the first documented case of agentic ransomware. The research also shows AI infrastructure and models themselves are now prime targets, while manipulated or stolen models are being used to accelerate offensive operations, including LLMjacking and guardrail-free attacks. #JADEPUFFER #Langflow #Ollama #Llama-3.3-70B #LLMjacking

Keypoints

Sysdig Threat Research Team observed “agentic threat actors” using AI agents to plan, execute, and adapt attacks autonomously.
A May 2026 incident showed an ATA moving from initial access through a marimo vulnerability to internal database exfiltration in under an hour and only four pivots.
Another attack demonstrated container escape followed by dumping Kubernetes secrets, reaching the orchestration plane rather than only the application layer.
JADEPUFFER was identified as the first documented agentic ransomware campaign, using an AI agent to enumerate systems, harvest credentials, and encrypt configuration entries.
AI infrastructure such as Langflow, LMDeploy, Marimo, LiteLLM, and PraisonAI is increasingly targeted because it often stores credentials, cloud tokens, and sensitive data.
The attack clock has collapsed: exploits can begin within hours of disclosure, and some cloud intrusions unfold in minutes, making rapid detection and response critical.
Attackers are also manipulating models through CTF-style jailbreaking and using “abliterated” models with removed safety guardrails to support offensive workflows.

MITRE Techniques

[T1190 ] Exploit Public-Facing Application – Used to gain initial access by exploiting internet-facing AI tools such as marimo and Langflow (‘move from initial access through a marimo vulnerability’; ‘found a year-old vulnerability in an internet-facing Langflow instance’).
[T1082 ] System Information Discovery – The agent enumerated the environment and identified valuable targets (‘enumerated the environment’).
[T1003 ] OS Credential Dumping – The agent extracted credentials to continue lateral movement and access protected resources (‘the agent extracted credentials’).
[T1552 ] Unsecured Credentials – The attacker harvested exposed secrets, API keys, and credentials from AI infrastructure (‘searched for and harvested highly valuable keys and credentials’).
[T1552.004 ] Private Keys – The agent replayed credentials to obtain an SSH private key (‘replayed them to retrieve an SSH private key’).
[T1021.004 ] Remote Services: SSH – The stolen SSH private key was used to drive SSH sessions to a downstream server (‘used that to drive SSH sessions against a downstream server’).
[T1611 ] Escape to Host – An autonomous attacker escaped a container to reach the host/orchestration environment (‘caught an ATA escaping a container’).
[T1525 ] Implant Internal Image – Not explicitly mentioned; omitted.
[T1136 ] Create Account – The article does not describe account creation; omitted.
[T1041 ] Exfiltration Over C2 Channel – Database exfiltration occurred after the agent completed its pivots (‘move … to internal database exfiltration’).
[T1486 ] Data Encrypted for Impact – JADEPUFFER encrypted configuration entries as part of extortion (‘it encrypted over 1,300 configuration entries’).
[T1566 ] Phishing – Not mentioned; omitted.
[T1213 ] Data from Information Repositories – The agent searched databases, config files, and credential stores for high-value data (‘database and configuration files’).
[T1078 ] Valid Accounts – Reused or stolen credentials enabled access to systems and services (‘replayed them’; ‘stolen cloud credentials’).
[T1210 ] Exploitation of Remote Services – The agent used SSH sessions and targeted exposed servers to continue the attack (‘drive SSH sessions’).
[T1595 ] Active Scanning – The agent scanned for valuable credentials and environment assets (‘specifically scanned for and harvested’).
[T1496 ] Resource Hijacking – LLMjacking involved stealing cloud credentials and compute to access hosted models (‘siphon AI compute’).
[T1565 ] Data Manipulation – The model-generated payloads contained annotations and reasoning artifacts used operationally (‘natural language reasoning and step-by-step annotations’).

Indicators of Compromise

[CVE identifiers ] Vulnerabilities used for initial access and exploit generation – CVE-2026-39987, and a referenced pre-CVE flaw
[Framework / platform names ] AI infrastructure targeted for credential theft and exploitation – Langflow, Marimo, LMDeploy, LiteLLM, PraisonAI
[Product / service names ] Systems associated with the agentic ransomware target and model abuse – MySQL, Alibaba Nacos, Ollama, Llama-3.3-70B
[Cloud / model credential types ] High-value secrets harvested from exposed AI environments – OpenAI API keys, Anthropic credentials, AWS access keys, cloud storage tokens, database connection strings
[Payment / contact artifacts ] Extortion infrastructure used by JADEPUFFER – Bitcoin payment address, Proton Mail contact
[Quantitative exposure indicators ] Scale of exposed or abused infrastructure – 175,000 publicly exposed Ollama instances, more than 130 countries, $46,000 per day
[File / payload artifacts ] Script and payload characteristics left by AI-generated attacks – 15 lines of code, payloads with natural-language step rationale, extortion table

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print